# CVE-2026-18810: H3C NX15 authentication bypass in network setup API

Source: https://junglewise.ai/threats/cve-2026-18810-h3c-nx15-authentication-bypass-in-network-setup-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-04. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-18810 · Severity: high · CVSS 7.3 · Published 2026-08-04

H3C NX15 is a network appliance used for managing corporate network infrastructure. A vulnerability in the network configuration API allows attackers to bypass authentication and gain unauthorized access to system administration functions remotely, potentially enabling attackers to reconfigure network settings, disrupt operations, or pivot deeper into the network.

Technologies: [H3C NX15](https://junglewise.ai/threats/technologies/nx15). Vendors: [H3C](https://junglewise.ai/threats/vendors/h3c).

## Quick answers

**Is CVE-2026-18810 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-18810 being exploited in the wild.

**How severe is CVE-2026-18810?** High severity, with a CVSS score of 7.3, published 4 August 2026.

**Which products and versions are affected?** H3C NX15 V100R017.

**Is there a fix for CVE-2026-18810?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-18810 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-18810?** Check whether you run H3C NX15 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is an authentication bypass in the /api/wizard/networkSetup endpoint of H3C NX15 V100R017. The exact root cause is not fully documented, but the flaw allows unauthenticated remote attackers to access what should be a protected administrative function. No special preconditions or user interaction is required—the API endpoint is directly reachable over the network. An attacker can manipulate requests to this endpoint to perform network configuration changes without providing valid credentials. Patches or vendor fixes were disclosed to H3C early; consult the vendor advisory for remediation details.

## Affected products

- H3C NX15 V100R017

## Timeline

- 2026-08-04: disclosed
- other: Vendor contacted early about disclosure

## References

- [https://github.com/coconut652-7/IOT_Vul_Public/tree/main/H3C/NX15R017/api_wizard_networksetup_preauth_hijack](https://github.com/coconut652-7/IOT_Vul_Public/tree/main/H3C/NX15R017/api_wizard_networksetup_preauth_hijack)
- [https://vuldb.com/cve/CVE-2026-18810](https://vuldb.com/cve/CVE-2026-18810)

## Related threats

- [H3C NX15 command injection in WAN repeater configuration](https://junglewise.ai/threats/cve-2026-18902-h3c-nx15-command-injection-in-wan-repeater-configuration)
- [H3C NX15 dangerous routine exposure in Web API](https://junglewise.ai/threats/cve-2026-18901-h3c-nx15-dangerous-routine-exposure-in-web-api)
- [H3C NX15 OS command injection in Backend RPC](https://junglewise.ai/threats/cve-2026-18900-h3c-nx15-os-command-injection-in-backend-rpc)
- [H3C NX15 command injection in reload.reload_config](https://junglewise.ai/threats/cve-2026-18814-h3c-nx15-command-injection-in-reload-reload-config)
- [H3C NX15 command injection in /api/esps delete](https://junglewise.ai/threats/cve-2026-18813-h3c-nx15-command-injection-in-api-esps-delete)